Skip to content

Escape terminal controls in setup path output - #210

Merged
smarzban merged 2 commits into
mainfrom
security-fix/escape-setup-terminal-controls
Oct 15, 2026
Merged

smarzban merged 2 commits into
mainfrom
security-fix/escape-setup-terminal-controls

Conversation

@smarzban

Copy link
Copy Markdown
Owner

Summary

tsk setup printed some paths without the terminal-control escaping used everywhere else. A skill directory (from HOME or an agent directory override) and a previous Herdr plugin_root could contain C0/C1 characters and those bytes were written straight to the terminal. Batch setup rows, the interactive agent list, tsk setup guidance, and the "previous registration is gone" notice now run those paths through the same visible-escape filter as a single skill write.

Test plan

  • cargo fmt --check
  • cargo clippy --all-targets -- -D warnings
  • cargo test
  • Manual herdr open-board smoke (if host paths changed)
  • cd site && npm ci && npm test && npm run build (if site/ changed)

Regression tests cover a skill path with an OSC sequence in batch setup output, a home directory containing that sequence in setup guidance and the interactive agent list, and a missing Herdr plugin root containing that sequence. Each test fails if the path is printed raw. Live Herdr smoke was not run (HERDR_ENV is unset). No site files changed.

Open in Web Open in Cursor 

Skill directories and a missing Herdr plugin root were printed raw, so a
control character in those paths could reach the terminal. Show them with
the same visible escapes as the rest of setup output.

Co-authored-by: Saeed <smarzban@users.noreply.github.com>
@vercel

vercel Bot commented Oct 14, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
herdr-tsk Ignored Ignored Preview Oct 15, 2026 7:32pm UTC

@smarzban
smarzban marked this pull request as ready for review October 15, 2026 19:38
@smarzban
smarzban merged commit 9b37456 into main Oct 15, 2026
7 checks passed
@smarzban
smarzban deleted the security-fix/escape-setup-terminal-controls branch October 15, 2026 19:38
smarzban added a commit that referenced this pull request Oct 15, 2026
… keys)

# Conflicts:
#	CHANGELOG.md
#	site/public/board-demo.js
#	site/src/content/docs/docs/keys.md
#	site/test/site.test.mjs
#	src/ui/input.rs
#	src/ui/render.rs
#	tests/quick_add_capture.rs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants